In this demonstration, we will create an infectious media attack,
and we will look at how we can create a QR Code attack for QRLJacking.
Another way to perform social engineering is to trick a
user into running some malicious code.
On many occasions when I have performed social engineering,
I've walked into a customer building and asked the
receptionist to print something off a USB stick.
Majority of the time,
they were willing to help without knowing that they were actually
being social engineered into plugging in a USB stick.
The Social‑Engineer Toolkit gives you the ability to create infectious media,
and this is found under the social engineering attack
vectors and infectious media creator.
Now,
the infectious media creator gives you the ability to create a
malicious file that can be run automatically,
and you can then, of course, either put this on a USB,
or a CD, or DVD.
We have two options.
We can create a file format exploit or a standard Metasploit executable.
I'm going to go ahead and select the file format exploit.
The first option that we have is to provide the IP
address for the reverse connection.
Next, we have a list of payloads that we can create.
One that I have often used is the Adobe PDF Embedded EXE.
This enables the social engineering attack to work because when
somebody actually plugs in the USB stick,
they run the PDF file, and then, of course,
the PDF file is blank.
At that point, I simply just ask them for the USB stick back,
claiming that the file is either corrupt.
So let's go ahead and use this attack.
I'll select option number 13, and then I have the option to use a built‑in PDF,
or I can provide my own PDF.
So I'm going to use the built‑in PDF,
and I'm going to select the Meterpreter Reverse_TCP payload.
I'm going to provide the IP address for the payload listener
and the port that it will connect back on.
Once the payload creation is completed, I have the ability to start the listener.
And you'll notice that it also gives me the location of where the file is
located so that I can go ahead and copy this to a USB stick.
I'm not going to start the listener right now,
and I'm going to cancel this operation.
We will revisit the same attack, but this time,
we're going to select the Metasploit executable.
Now,
the Metasploit executable gives me the ability to go ahead and
download and run my own executable, or I can select from the
various options that's available.
I'm going to use the Meterpreter Reverse_TCP payload, and then
I'm going to provide the IP address for the payload listener.
I'll provide the port as well,
and then the Social‑Engineer Toolkit will go ahead
and create the payload for me.
Once the payload creation is completed,
I will have the ability to then copy that to a USB stick and use
it in a social engineer attack. Bear in mind that when you use
Metasploit payloads, a lot of those payloads are detectable by
antivirus technologies,
so it would be a good idea to actually run that payload through
some further obfuscation to avoid detection.
Let's take a look now at how we can perform QR code attacks.
QR codes are often used in QRLJacking.
QRLacking involves social engineering,
which is capable of either session hijacking or credential
harvesting, and you can use it for any type of application
that relies on a login with QR code.
QR codes are everywhere.
You'll notice them on products, concert tickets, advertisements, and much more.
The purpose of these are really for marketing and for people who are looking
to obtain some more information about a specific product. Due to the wide use
of QR codes, attackers and are now using it to social engineer unsuspecting
users into scanning them and providing sensitive information that can be used
against them. To create this type of attack using the Social‑Engineer Toolkit
is really simple.
Within the social engineering attack vectors,
we can select the QRCode Generator Attack Vector, and the option that we
have is to provide the malicious URL. So I'm going to go ahead and provide
a fake malicious URL. And once I hit Enter, the code will be generated and
stored in the location provided.
So I've opened up the QR code, and this is what it looks like.
And when I view the QR code using Web QR, I can see that this QR
code redirects me to the URL which I have defined.